Commit bd697183 authored Aug 28, 2022 by Wen Gu Committed by Litao Jiao Nov 27, 2023

anolis: net/smc: delay RDMA resource release until connecitons freed

anolis inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I79GVV
CVE: NA

Reference: https://gitee.com/anolis/cloud-kernel/commit/301e72b8a776d6e7e327dabd1f7f2bf8df40ebd9

--------------------------------

ANBZ: #2003

When SMC-R links down happened, the RDMA resources like mr,
QP, PD are destroyed immediately. However, there might be
some SMC-R connections still invoke them, which causes an
use-after-free panic.

So this patch delays the RDMA resources release until SMC-R
connections are all freed.

Link: https://gitee.com/anolis/cloud-kernel/pulls/677


Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: Gengbiao Shen <shengengbiao@sangfor.com.cn>

parent da9ffbd6

net/smc/smc_core.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -769,6 +769,9 @@ static void smcr_rtoken_clear_link(struct smc_link *lnk)

		void __smcr_link_clear(struct smc_link *lnk)
		{
		smcr_buf_unmap_lgr(lnk);
		smc_ib_destroy_queue_pair(lnk);
		smc_ib_dealloc_protection_domain(lnk);
		smc_wr_free_link_mem(lnk);
		smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */
		memset(lnk, 0, sizeof(struct smc_link));
		@@ -786,12 +789,9 @@ void smcr_link_clear(struct smc_link *lnk, bool log)
		lnk->clearing = 1;
		lnk->peer_qpn = 0;
		smc_llc_link_clear(lnk, log);
		smcr_buf_unmap_lgr(lnk);
		smcr_rtoken_clear_link(lnk);
		smc_ib_modify_qp_error(lnk);
		smc_wr_free_link(lnk);
		smc_ib_destroy_queue_pair(lnk);
		smc_ib_dealloc_protection_domain(lnk);
		put_device(&lnk->smcibdev->ibdev->dev);
		smcibdev = lnk->smcibdev;
		if (!atomic_dec_return(&smcibdev->lnk_cnt))